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57) Abstract 

A data converter has rounding units (38) 
:ach including a nonlinear function section 
304), and each nonlinear function section (304) 
ncludes a first key dependence linear conversion 
tart (341) for performing linear conversion based 
>n a subkey, a dividing part (342) for dividing 
he output of the first key dependence linear 
inversion part (341) into n pieces of sub-data, 
irst nonlinear conversion parts (343) for 
lonlinearly converting the sub-data, a second key 
lependence linear conversion part (344) for 
inearly converting the nonlinear conversion 
jutpuis based on a subkey and outputting n 
>ieces of conversion sub-data, second nonlinear 
■.onversion pans (345) for nonlinearly converting 
he conversion sub-data, and a combining part 
346) for combining the nonlinear conversion 
mtputs and producing the output of the 
ion linear fund ion section. An nxn matrix 
^presenting the linear conversion by the second 
xy dependence linear conversion part (344) is 
romposed of n vectors such that the hamming *' 
vcight for a safety threshold T is T-I or more. 

fherefore. the resistance to the difference decryption method and the linear decryption method is strengthened 



304...NONLINEAR FUNCTION SECTION 
322...KEY STORAGE SECTION 
341 ...FIRST KEY DEPENDENCE LINEAR 

CONVERSION PART 
342 ...DIVIDING PART 
3430-.NONUNEAR CONVERSION PART 
343, -.NONLINEAR CONVERSION PART 
343 2 ~NONLINEAR CONVERSION PART 
343 3 _.NONLINEAR CONVERSION PART 

344„SECOND KfcY ObPfcNOENCE LINEAR 
CONVERSION PART 
345q --NONLINEAR CONVERSION PART 
345 j ...NONLINEAR CONVERSION PART 
3459-XONLINEAR CONVERSION PART 
3453 -..NONLINEAR CONVERSION PART 
3<1fl...COUHINIHG PART 
347...THIRD KEY DEPENDENCE LINEAR 
CONVERSION PART 
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^n^^^^-r 5 m i (343) *tib <D#m?m&ft£> *mmz- 

4)4:, ^ tl?) W^r-^ 2 »M (345) i , *<Dft 

@^#^ff^^(344)(Z)^«^^^"rn X ntt^JS:, S^teMffiTKfct L 
^ 5 > ^m^*^T-l # J: £ # 5 n ffl0V< * h /WZ. ± 19 «fife-t" S - * 5 
ttfe, *^¥W«SfeJ-*|-bil»<4«r3t<i-So 
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ES (Data Encryption Standard) Bf-^-^fcSo 

*ffifci**<fc*fctt«**fr5. HiKfc^-C. 

H2(OJBi9^^Kftiaffll4 I (i=0.1.-.l5) lc«tf-^«*«tfc6BB» 

R, =L„©f(R 0 . k o) 
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L, =Ro 

*IJ14, iCfca&S&SS i lfe<0 7 *v KMliff^^ <b^-T5, fc/fU i=0, 1, 

••• f i5 x*hz>, o*t>#9^^ Ktossui 4 , (o^ i ^ i 5) -m, 

R,„ =L,ef(R,, k,) 

&-g-*Q.Sl-*s^-tli. BS&f (B8#8&3MHS 1 2 ) IdA^-fSS'Mk,,, k,,"-,k M , 
k ia <a«HJ¥fc*tf £iStE£*-C, k is , k H , •••, k„ k 0 (DJii(cA^i-^ £ o J-i" 5° 

^«t«3, fc-SHttSl-^^l^**^^* 1 1 f^A^LTEM (D&m&mrrT 

gJ52 0 fi, i£*«£j#/l'— ^ 1 6T6 4 If y h©il^'b 8 \f y Yft<D^ V r 
4 \Zy h£l&V^c5 6 \fy h&tt2 8 My h -fo<D#t:r-^ 'J L . *ix?> 

=§-2 8 hco&^^r-'— ^tc*tb 1 6l£©slfeU f #*.teg£:fTi/\ #J£oftU<# 
^S^Ofe*?^-* (f+5 6 ITS' M *ag^t5iH-«t ^-^tfcSM 0 
<Dttfc1rZ>? Vis KUl-5-;L5 1 6fi<754 8 fj/ hcogi|^k 0l k„ k,„ k 15 > L"C 

MMWU 2tf>*&3i3. HI 2 (C^i-=t ? Cff^S. *i\ 32Myh<0 
y p ^ f - ^ R i ttfe^^IHi l 7 t* 4 8 t' f - n (R ( ) ll^^^no. - 
KtCl-lMk^-C^til^fiSfP^ XOR0&1 8T*I&<9, 4 8t'7 hx-^ECR^©^ 
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bfDtiiJj&n&c CCQS-box S, ( j=0, l, 7) ii6f ;/ hOA^f-^^ 

6 4 try hc7)tH^r-'-^{C^^-f-5^^^m^-7VH;fo«9 , DE SBf-^* 

ffftfc^^tt&jSo-ci^saJ^fcs. s-box So-Sfrosooaj^jf-^ii, ?? 

*£«>-CJBj*#J#fl¥SEffira, E. Biham fcilO^A. ShamirtC X o T "Differential Cr 
yptanalysis of DES-like Cryptosystems, " Journal of Cryptology, Vol.4, No. 
1. pp. 2-lZ\zm^£tltcW7$f&%% ; fet , Wiot "Linear Cryptanalysis Me 
thod for DES cipher," Advances in Cryptology-EUROCRYPT' 93 (Lecture Notes i 
n Computer Science 765), pp. 386-397 KffiSgSftfc&JfcteSfiifc 

AX = X©X* 

^p-^f-^^di, R,), (L*„ RVi-TS. -bRM^^tcfc »? 
AL; =L,oL', 
ARi =Rj©R*i 

*5fifcS£i-5. 1 td*3^-C. L,,=R H . L*, r =R* M , L IB =R Iit LVR'^^t^S 
R l6 =L, s ef(R, 4 . k 15 ) 
R* lfi =L*, 5 ©f (R* 15 . k u ) 

AR, 6 = AL ls ©f(L lfi , k lS )ffif(L 16 ©AL lti , k, 5 ) 
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ft 5 : 

f(L lh , k,,)ef(L lfi ©AL 16I k 15 ) = AR lfi ©AR,, 
I"J«ik l8 *s**o-CL*x.«, Sft0 8(SP^56-48) tr* M**£Sfc9TfclBS«M::3fc 

. AR i( | = AL i ®A{f(AR i )} 
AL H , =AR iM 

? ^ifi{££ft5 ^ Mi, fe 5 AR , ?js A^ £ftfc t * , 

Tii^iiJ^^^^^^-t^^^ii^^^^^^* 17 '^ 50 W*fi\ s-box s,re 

9 KX*<??jfifa*iiJeU-CUK ^tX\ A R M tt5fc*P=n "CAL,,, AR (1 (A 
L u , ARoli^^b^bi-LSx — ?X*>Z><DXA^ : &Zf-<omi$X2bZ>) ri^sftafrfe 
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(L„, R 0 )r(L n , R„)©(L 1S , R IB )r(L ls , R 16 ) 
= (k n , k,, k„) r (k„, k M k l5 ) 
/cfc'U r(X) ttX^Slwiry Kll^SjRtS^ -?^^ffii 

(L n , R 0 )r(L (1 , R 0 )©(L 16 . R 1B )r(L lfi , R 15 ) 

(k„. k„ k, s ) r(k 0 , k„ k is ) (i try H 
roitft^^Jiaiv^- «t^^6o r<p£#* (U, R„), (L 1( , • RJii-tft^WP 

R 0 ), r(L 16 , R 16 ), r(k 0 , k„ -, k ls ) Sr3Et<**5^m546tf, <k n , 
k„ k ls )r(k n , k„ -. k 15 ) (l X-yh) t#ft5Cfci«-e#5. 

tDS-box *s«*p., tWW5^<o ^ --CcDtf^Mi, S-box K*H" 
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"iiii (2) "^$j£n5fc&-efc5o rnbs-box \z&rtz>-?*?m.*'t&?i~&t>^ 

3^jis-c#, 4-7^^K-coi»^m*ii*SL - c^<-t-c, r(L 0) r„), ra„, it 
16 ), r(k„, k„ k I5 ) nnm 

p = 1/2 + 2 , • :i ^ j ,„ ,5 1 p f - 1/2 I 

<5 o 

ta^±5i:, zo^ttisfe-Cs 2- ,:i iaw»^ • Pt^om^^^r, des 

(&£S0 Srtf-^-r^ irT'foofCo 0!l*.H, D E S P£-§-£ 3 ooft Jf fcTriple-DES 

Jp^-ttSZ ill, Bff^kiS^Srtlttl-i-S-iJ-^S. 7?>K1&&3 
^I3ti^(i\ B£-§-{fc&gfil/3 Klft*. oJ9, »DES B£-5§-<£>Hf -SHfcis 
^{iPentium PC*7*-C«fcl OMbpsT'fcSfctf), Triple- DES Pf t 5 i **J3. 
5Mbps *-CB&#{ba«^(e:Ti-*. -^-C% hV-f^^^t'^-fteiflt 
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K t&PJ 1- Z> o ^ >2l \^M'h,mi3t^22 a ~22 N „_, £ ^-T 5 N/2 (Gil 

X.tfN=16) ££<7)gf*0r31S&21 (1 ~21 v/2 ., frhfo&o #®toSai21 J (j=0, I, -.N/2-1) 

— ^nfc*j5SAn^^.t>ix-cjfcSoie*asffls2i J41 izttm^—? t lta^^^i 

Xtltem^—?lZfr&(DXt)tEm : T-*kLXtiit)£tlZ>o #«*£«k«J22 J Otttfj 
2j9 ^> K*&a©i:Sgi+i=2j+l7^^ K*aa©:»c4-^.e>ixS. 

*&3g*l521 n Kfe^Tfefc^— ^«&*fc*&22 0 iZ J; «3 LTfcfcifcfe 
* <t LT&fScDgt^Jimi, ^^-x.5 0 ««tS§P21 D ~2 W^tetfcg^,, ~22 N72 . 
1 4„ ~ 1 4 s .,Jd#x.f>ix5. 

„*. Q,j. 3 *««WLfcfcfiS+st, »j+la©«tt»»22 j . 1 ^w*5v^r, *©ffi*j (iu 
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*?>t^-$ tm&m&mm2z^<D-*o>xt>7-?x°&&mm%y q 2J ., 
bp^. 3^ttj ©^ittfc^^oai^-efcaBijeQaj.,. q 2J -, 

fitWH«&»«-C§TL4 ?. r r-Ciiil^bfc 3 &fi(DWmtf** Z>k± 

I^^W-T * . - *^ ©S-'U-T't*-* ^^*jeac**rtT 5*1* 

* (cs<5 v ^*a*fe***r 9 «s 2 muztf'mm&m t .torn 2 
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P (<d -c&5<t#, G-mziZia-rzt z^-g^mm • mmm*?, (fc 

LT<7}i»fiP^P i ^P ,, ^6o 15 tw. #Kn = 4©»^©SS 2 

was 4 ocDU-y^'-* fabm/vX 3oi e-r- * ^ 4 #*ia> 1 oo^tettassfn 
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[21 8 B 2 HJfeMl-*3tt S*«l?K^tft«FP344 <0^ffift«^«fifc£^1-|2U 

in i o nmmm 3 [c*s^^#^M^343 <D«t6«^sr^-ria. 
mi a ami 3 Visits *«ft^Ba»«B304 <7?«flg«fiS&^-reio 

El i 5 Afi^milc^Hy^Sfc*!®^^^*^^^^*^ 00 

Ull 5Bte[3l 5 AK*5tt<5 1 OCOSE&^**<0«J#&*"*"lSU 

El 1 6 teg^T/i^ y X-Mdcfc |9^bfcJ»^4ftSP344A«)«fiJc0i|Sr^-ri2. 

Ell 9»i*43t*Wi*3»t5BIl 4+©»2*fc#*JB«*»344 ©XfcflfcO 
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m 2 o cmrmmfemtt,' <Dmmffij&z^-fM, 
-rnio 

[212 4 {±1112 3 AXIS 2 3 B * 4^£I:£J&SI5230 (DmZm&m&^-tZ? v -y 
El 2 5 (Dmwzm 3 O^^^^^-^B^iiffi 2 4^tf)G|8 

SI 2 8teC<D3S^£ 1 2 8t'y FSr ioO^ds/^ t1-SFeistelS!l»t-§-^fflffl 
% W & M H& i" -5 ft & <75 M 
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mik? V K^3g-r5N^{C,^^^ixfc7 K&S«|538 0 ~38 v . i aS|5:ft <bzV 
QyV^ KA&38B38, (i=0, 1, -,N-l)f±Bl 1 ©7^KW 1 2 {d#ffc-t-£>#& 

-^-MB2 0lt flA^320 ©x-^dfe/S^l t. «SfStft«FB322 <b ?J> 

^-^^/5fe§[5321 IdiD^^T 2 '-* (I'Jfil) 

{fk; k on , k 0l , k 02 ; k 10 , k n ,k, 2 ; k (S . 1)( „ k (N _., ,, k< s -, )2 ; ek} 
tf£.f£Ztl. ©BE««R322 it 5. A^lfcx-^MIi, «IE1«f|5322 

^^^HTV>^,^7 : -'-^fk^J;S^^ii^#^^^302 T-^m^nfc^, 4B8I# 
#J£|5303 ^^ojx^^-^U, R l) ^^f | ]^^S 0 ^ilf6 4 t' 7 l-tOr-^ 

302 t?fi % 0i]*.tffi|-7 f — *fk£ A^IT-'— M i: (DM^f^Sf O-^li^'— ^fktdj: 
t-/Dy^f-?R,li, aiEtft'^322 ^^^nTV>?)^-^k„ (1 , k () „ k (l .,<h 

M^304 •c^jg^tesicjzu^-^Y^ift^na. f-ni^ p ^ 

^ RJi^-^5306 Xy t —S f fitS C^?^) ^'fT^K. L,— R„. R,*-L„* 

aTx ^ i ^7^^ K^M38 ( (i=0. 1, •-.N-DiCioV^T, 2o«A^o^ 

~-*L„ R.KOI^T, T-'-^Ri^> eSE«ei5322 H^^iXX^O^^-^k^, k M . 
k i2 t Hl:«W04 HAASn. ^Jtft^Htt«304 T-^?F^m^^ 
ftfrtlX. T-^YiC^^n^, f-^Y i fc7 f -^L,li»JK?»lt«B305 Till 3? £ 
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Pf -Jr^SrfT? tfeOf- ^SCtftOTt LTco§Sc^t4SrSi(S-t-*fc«><^ig§]<eiBfe 
OiSLlll^: K@aft) ^N^-T5<ir, 7 £ > KMSfC38 u ~38 N .,lc: «fc 5*£ 0 

SgL*&3fc>*a*. fe» ^a**^— *U, M^^^S. ^co-x — ^U, R N 
#*JS&£-{fB307 -C^-g-L. o-* 9iWx.fi 3 2 f-y hO*U, RySrtTy H^Lt6 4 

5/ h CO x — ?t L, %<DVt* StfEts£l5322 K«fR $ nt^58lf- * ek(C «fc 5 

A^VXM^IIbtlS. *JI*«ifiS#S»aJ308 75- . #JJB«fli#£&«B302 

©iggE&Kfc oTi/^ft&ll @4 Cfc^tA^r- * <o\X Q lc -7-'— f £ 
A^JL. §&^r — 9 £rlH 4 t tiiglC, ek, k (N _ IJ0 , k,,.,,,, k (N . ni ,, k 10 , k„, k 12 , k„ 

o. k 01 , k 0 ,, fk&Mtk-S-X-ftli^^o 

M i ^7 £ > K*aaffl538, <DAt>7'v y # "f— *R ( &. ©fEtt&£B322 ULSWSit 
Tl^ttx-^k,., k M . k i2 fc£fclc#ifc^«»fflS304 -^f-^/^ t . 7" 

fc^— ^R; H55-WSB342 i:fc^ti?ati8 k'y hdo©4o©T-^in„, in,, i 
n z , in 9 tcfy h^SI$ixS= 4o(Df-^in 0 , in,, in,, in 3 fi, ^Hf^i^ 
^^343,,, 34 3,. 34 3,, 343;,K::io^-C , f-^mid m , mid,,,, mid M , mid o: ,(C^^^ 

■id,,. mi d C2 , «id M «:*ttM-cE^«^*aa (»tewiiaiu) L-c*rfc&4o*> 
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^n«Ifcl (Ifeft!ltfj8fe3?n) LT4o<D^ftc<D;f-^niid„„ mid,,, mid,,, m 
id.^ffi^-f £ c wftfc 4o^x-?li^«'£&£tf345 n , 345,, 345,, 345 a {CA^ 
^^b^-'nr-'—^outo, out,, out,, out :( <h£H5c wtlb 4ocotH^r f — ^ 

x&rtbtiiif-ft&m&ti&o*. 3o„ 30,, 30., mx<^(Dmw^£z>7^=i v xa 

m If -y b W A^lf - ^ ii^ll-eil^^ n iro^iJf^M (S-box) frbm 

i-©ni©mt'7 hmti^tnrmrmm^-r^^mom'mmmu (s-b 

^SUT'fcS, ~<D^^<fctU£\ ,^»^344A^{0, l)±©nxn^lPi:l 

lc^UTVKCi:(a^ *jS/«Ci»^^^344A«:»fiSt-r5o fcfc'U f2l 
^#^^§[5344 [c^^n^I'J^kn KJ:S&fe^*T*JPKJ:9ft£L;fc*ft?& 
3B«ifflS344A^*f UE 7 fcjjW £ 5 (-«#^^344B t Ltf+JDt 5 d t t i"6 0 
fc*3, " flTfc^ ill, ±KO«5t£Wi-5#^£&B344A<rc*T'g#«¥ 

tfij X. (i* T / < 7 >- 3- * f i w o v ' "C * as * ^ ^ * ^ * a ^ ' f T " f * * v N c 
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j=o 

"0 111" 
10 11 
1110 



*3 



1111 



z 0 

z 2 
z 3 



(2) 



-C*$n-5 4x4tf?'JP K *8ftWi-5. tT?iJP E KKHBl* 
£XT<Diif£$:&1rZ>o /cfc'LS-box «±¥.JW"Cfe5 iiR^i"6. ±fStT?'J5U- «t 
flfc^SaxSz',,. z ,. z'„ 2', ll^ixfiiaTwajffe^L-Ci^, 

z' 0 =0-z n ®l-z,©l z 2 ©l-z 3 =z l ©z 2 ©z ;! (3-D 

z 1 = l-z o e0-z,©l-z 2 ©l-z 3 = z 0 ©z 2 ©z 3 (3-2). 

z' 2 =l z 0 ©l-z,©l-z 2 ®0-z. i = zo©z 1 ffiz 2 (3-3) 

z' . ) =l-z 0 ©l z 1 ©l-z-.©l-7. ;i =Zo©z l ©z 2 ©z 3 (3-4) 

&&tomRvmB&&iztti-z?ti'h-te&<om&n. active s-box 

(ttm&m . £##afcfe-CteA*£#ffiAxriS##T-fcfcs-box tractive 
box bFf-£>o 
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ft < . ^o7/<^Vatt* s J:< ft*r?iJ P &fcfcfc$K#t7&£&*R344A 

-T 6 J»® SE*Tfiro344 A & So (t 3 3. £ # t? # & fc. ft -c h z = 

Step 1 : gc^teBBteT (Ttt2^TSn/i?.IIc) £t££-r5o 

Step 2 : ^Si^g^T-l ^±^5?'^ h/Wl^CSrfflf t5. 

Step 3 : ^C^nfi^'P** h A-cD^P^il^i-S., itff)»©^S«:%7 

Step 3-1 : yij-i^ h/K^RPj^ol^T, n d £#&£ 0 w K> d t &-n d (P e ) <t ^ 

Step 3-2:n d (P c )£T JfePstf, tOnlBOJH^ h ^T*f#/& £ *l 3 WJP t 

%mwn&it Lxum-tZo 

Step 4 : ±X<Dmm=m<D*X. ft^n^ffit^AfcWJPin^PXOlliSrW 

- £ iSfttE* Jx5c ***** t * * X 0 KftW P ld»i±1B»*T^ 'J X 

A**fT+aSKT*T=n. n-1. 3, 2 ^ifoi^LTVK^t', ®> 

Jfs«fc<fr?"]P&35fL"C**o 

<iit^bn5^*iltf, Step 3-2«*tTLTn,<P r )ST***ff*J*S*> 
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t^-Z'rt&lP t LTfffl Lt "b foSl^tt. Step lSr^^TL. Step 2T''^ 

8Mf£2!&g|S344A(0A2>-r * * fifcfi, *&H£&4fe-*R344A<DfcH;fc-v ^ * ffiO^ft&WSft 

"T-M 1 : >D!Uf5§£&§l5344AdHO, 1} ±^ n x n ff ?'J P "C^X. 6*1 fc. t i"5 0 Z.(Dt 
,W^^|5344AWA^M^iiiA z fctHrt^HSAz' £<DlHtf* (gSMfC'**) 

Az' = PAz (4) 

rz = T prz" (5) 

^$sgfT£'J T P£-fflW;:-7;* ^Mit '^t-fctf^active s-boxCD^'Xlfctaln] C^fo 



Pc = 



"0 


l 


l 


f 




"0 


l 


l 


f 


l 


0 


I 


l 




l 


0 


l 


l 






<=» T P E = 


l 


l 


l 




l 


l 


l 


0 




l 


l 


l 


l 


l_ 




l 


l 


0 





(6) 
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(1) 8M&toifeafn(X0R) <EHB&&flW>i::i-£u Xtt 

(2) mcxitemm&.tmv&i'&ftz* 

Step 1 : ^T^iJPi-ioV^T, 2 owif SrilfK U — #£>fT ( a it) 
?T (bft) ZbQZ-Z (S**SJ* £ P^S) o 

Step 2 : £:£fc£'©^<S:ffl^-C\ ^JP^TO^'J I Klft 5£-Cff fciSftU 

Step 3 :»^&|fl344A&«j£i-5;fc«>l^ Step 2T##fc^Mf<7}i£MfU::, 

©^ r ft:'CTS:'8?lJ^.fi® 7 l£7F-f. lft?K^*lHJ344A^4oV>r» -7"'— ^mid 0() , mid 0 „ mid 
02> mid M fi^n^HMa^30 0 ~30 3 ^A^£*K toS^30 0 -Cmid ul , traid 01 i <D 
ffil&m&mfatf XOR[e3SS31 0 XkbiX. -ttcmmmo, T?mid 02 >X0R[s]Sg31 n <om 

t> t tovmtommm* xor@ss3i 2 xkbti, m^-co^m^^mtnn^mmo, 

<7}XORH]S£31,-Cmid 0 , k <Df#te#jfraS?0# 1 <bn5 0 
MS^30 : , -CX0RI1I?S31 0 ^{±S^<bmid 0:( kcom&m&muft X0REI&31, Xk b 
*L, ^31^30, T-XORE3&31, WtU^ t XOR0&31., <D&t> t (D&MtolSEfatf XOR 
E832, Xkbti. «LS^30„ -CXOR08S32, CD ffl*> £ XOR0SS31,, <D liiJj k (Dm& 
WfifeSfP* 5 XOR[hIS§32 () t^H6 t 

X0RH]gg32 n , 32„ 3i„ 31 :i O^ffi^J £ I'WBt*-* k„ 0 , k m , k ii; , k MJ iO##«l 
ftffi&JSftlri* ^#^^P344B(DXOR[H]5f§35 ll ~35 :1 -C'^ia^rtui "btLT, -tiX-fiXm 
id 10 , mid,,, mid m raid ia *ai^i-S- of: !> rWmid,,,, mid ()1 , mtd 0 „ raid M «ti 
51KMiS<5H-P>ft;fc&, s ttiZ?ft£8 V? h(DUmy"'~- *k 1I0 . k UI , k u ,, k li:( 




i 10 



(7-1) 



i 1 1 



(7-2) 
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mid l . J = mid nn ©mid (M emid o:: ©k iu . (7-3) 
mid,., = mid O0 emid ()1 ffimid a .,©kj, : , (7-4) 
I'Jglk n li4oOf- *k iI(l , k lM , k uz , k M1 "eil$Siit^4: 
HI 5 i^yjk. Lfc i 5 {*x CiX^-r-'— ^mid l0 , mid,,, mid,.,, mid n li, ^Zft,-^ 

it#IMi^&SR345 0 , 345,, 345 z , 345 :( {-*3V^X, t"— ^out„, out,, out,, out 3 (C 
m^m^^tltc^. *§«&*|J346 -oOr-^i' ld*£-&£*T,*o o£ 

•9 tf'J;U3:4 oco 8 \fy Y<D"f— l ocq 3 2t*j' h 7* — $ \z. £' h £;ft,Oo 
7-*— ^Y,* tt N ^k, 2 lcJ;Sm3«l»fip«S^4ftW347 C:*5^T, m 

X-tf-r — *Y,* &k i2 — 7" — > a V|d<t 9 7-*— ^Y.K&J^&Si-u 

fl2Klf&IHS304 *>?>^tii^r r — ^M^^ixS. ^ff^^C343„~343 ; „ 345,, ~ 
345, (D-tiX^ErixH. WilfDE SBf#(^S-box (75 J; 9 ft <E> T* £> 9 , WilJRO 

--X\ ^^^^343 n ~343 :i tt4o3fe?iJlc:IEm$^T*5'9 , -t^&tfe&Sfi 

$U345„~345,fwOV^tlSl«ICO-^*SV^S„ CKDfc*, ~ n b M^l^j&fi^ 
nmi^f^ (^J»^I58!BC§P304 i:LTI±^2^T3//) d <t 

*ST*#£. «ff^&£l5343 ( ,~343 :l , 345 0 ~345 S OS^?«^ • »®«6** s P 

mmviOA ±mz&\-t z&fttem • w^iip 4 tfcs. fto-c, x-^gfcg 

S^fr-Ctt^lS (9!>^KIS) ^3r<t L-CMP^p 8r X3fifa^mT*t, tf0xJ2*r = 
4 (fj*»l 2S) ^i-SirP^-CfoSc :illiDESSfft^It5t4 8^ 

ft 6. 

ft*5, fii-r — ^fk, k 00 , k 01 , k w , k |n , k,,, k 12 , k (K . 1)0 , k, x .„„ k (N _„ 2 , ek (i 

ey *>fc»7*-*£fifcSIJ321 ^ J: oT^^iX, 8tSEtS«J322 ictieixtf-^ 
T'£><5„ gl7-*-?£J»321 ^ J: 3«t*- 9 <7>£>&I2. D 1 t-^ Viz D E S Pf % 
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m4\ZTjkLtz.^nmm^^mo2 % *n&a##£&£B308 ; sterns m^l 
iz&ttmi&m&mot ftcDmfcftmm&UMu 344, 347 tistm&^-r©^ 

Sr£t£ £ x. , * fill L fcnff fgfT' fe ^ c 

41. 344, 347 ^oV>Tfi, ^O^-f KtS> 1 o£giJI&-T 5 , .X LfcV^E 

(ommmn. ms\^rtz}rmmmiM\, 343,, 343,, 343,^^9^, ^ 

JeneiJx.tf 8 tj/ KWA^Jin„~in a IdttLT 3 2 t" y h ©iS^-^MID*,, MID,,, , 

mid 02) mid m zimm^m^tv A~8Dx^immm 
mmza ~343 : ; u «fc#«t^&&*&344 Rtigi^t^OTt 

0 , k n , k iv ^*^^?Fmm^304 -.©A*f-?t*5. ^-^R.tt. 
k l0 tdJ;4J(5l«*=flF*^«*»34l «x«»ftfeW»afDtiJ:«9^-^R l *=R, 

in,, in 2 , in :) lC^fi|$nS 0 40©f-^in„ in,, in,, in, f±, *n*r*nEI8A 

^8D\^-r^mmmm\\ 343/, 343;. 343; \z*>^x. ^-*mid mi 

D 01 . MID M . MID M ^*»a!**^5. ^*m«!»S5343^ m br 
^*»»34Vtt. »lHlfe«!lroBI5»i*5»tSN*«af*fflJ343 B ^^t",h^) 
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7*—* mid*, *±(4mtr-y ht ^XtUt)^^ t Tttmty Mll£f-^'0 

0- -0 (2) "^ai^-r-5 J: 3ffijsfc£nfcS-box ^©Himf> hf-^mid„ (l 

£:fc*Siic:«fc«9 3^^tcaj^-T5 t*limt"7 h©"oo-o (!l ' ^fctJ^-TS X offi&ts 

M1D 00 = [mid 00 , 00---0 (: .,, mid on , midj (8-1) 
{^&-T53M£T'fc3 0 ^^^15343,', 343 2 \ 34 3 3 * MM'tlin, 

in,, in ;) 75* t» 

MTD„,= [00- -0, 2) , raid 01 , mid 01 , mid 01 ] (8-2) 

MID n2 = [mid 021 mid 02 , mid fl2 , 00— 0 B) ] (8-3) 

MID in = [mid 0:i , mid M , 00—0 (2) , mid M ] (8-4) 
\Z.&&-r S^JST'fcS* 5t(8-l)T'^^n5-r-^MID 00 ©ifeib;*rtt, ^fc!H7CO 
*|?122£lft«B344At::*5l/''-C7*-- *mid 00 W^^-r — ^tnid 0 „ mid w . mid 0:l ±T£r^T*-L 
^"00- • • 0 t *3 V n fc *J (C m*mym?>AA k<D ftf] 4 W<fcK'&hftZ>7-* 
*M1D 00 ti-ntiiV^ »TIH«II-U-C^:(8-1). (8-2), (8-3) tf^2>7-^ 

mid 01 . mid,,,, mio m i^^t t ^^m^cftfcs w i is-e# 5, zfrbimm 

3E^ffli343 0 ' ~343,' fi-tH-t'iX^—^ino. in,, in,, in 3 l:7K^i:U f-^M 
ID 00 , MID,,,, MID,,,, MID,, 5riir^tiit^T-7> LT ^ D ia ^tM U 

&g««B344 IcA****. MID 00 fcMID D1 ttX0RlHl!»41T»ffiWiaafD*Si:f,^ M 
ID 02< tMID 03 H X0REBS42-C»flfeWMiaft**i:bH, X0REK41, 42©MW^«)*te 
W»afD*sx0RISlK4 3T*£ fen, X0R@te4 3©^***^-^,, 
aft*SX0RIilK4 4T*ir bW= XOR0K4 4©m*IIID 1 tt#mK'y h^tB^mid,,,, 
mid,,, M„ «6 n K**h*m**>r*M**'*. i©»2«B*ll** 

^344 te&5£ 

MI D, = MI D 00 ©MI D„, ©MI D ft2 ffiMI D M ©k , , (9) 

<T> : & It* A *W&Wfc* % • 
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m i d , „ = m i d 00 ©m i d n2 ®m i d on ©k j 
mi d , , = mi d„, ©mi d ra ©mi d o: ,©ki 
mid I2 = mid 00 ©mid(,|©mid 02 ©k i 
m i d n = m i d 00 ©m i d 0 , ©mi d 0 3 ©k j 



(10-1) 



(10-2) 



(10-3) 



(10-4) 



-Hits in 7 ^*3it^M^mxt(7-i)~(7-4) kmm*mj&&&-eihZc 

9(;LtI 1 MMintm^T-*— *mid l0 , mid,,, mid,,, mid,., £ fc*3, 

k„ i±4o©f-^k il0 , k in , k n „ k in -C*«fi)£$n-CU>5. 

-r — ^mid, n! mid,,, mid,,, raid,, tt, HI 5 \Ctf Ltc<D t mm^^tl^ftx 
#1&1&M&M34S 0 , 345,, 345 2 , 345 : , l^^-C, f— *out 0 , out., out,, out, 
lt®HJ& : £&&fttc&. ig£^H5346 l^V^T, 4oOr-^out„ out,, out 2 , out., 

@8A~8D ( 9(C^Lfcf£2|)g»JIC:fcV^ |8A~8D©»I«3 
43 0 ~343 3 «fS 1 3Ufe0»Ji i^l«{:^*l^8 hW^-^midoo-mido, Srttl^ 
"T^S-box <0^-C«fifeU, 18 A-SDT'SLMi 8 X -y h (D"00-0"^tt5^ 

-OSS2^Jf£0iJlw*3Jt5lg2««S#i»^af«HFB344 T'li, 13 9 1^ L J; o \z 

mi*Sfe^ir[5]«(c:, »^»^343 0 ~343 ;( t 345 0 ~345, l±4ofo 
^Jii-^-C^lJIStT^Wffi-CfeSo HIC. ^Jf^m&IS343 (1 ~343 : „ 345 0 ~345 :( <D 

m 3 nmm 
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% i mmwtmmz., m4i^i-mmffij&&G-rzy-'-?m&%imz&^x. 
^ser-^k,,, k,„ k i2 t th\^mz?&mm* -A^^ns. 

tfy hflD4oCf-^in„, in,, in 2 , in., ') £ H&o 

2Mft?ea?&*R343 0 lw*3^-c\ f'J^tflDl Otc^-TJ; 51^ in„ f«lw0>J;itf 4 tr 

* h02c©Wn -y?in otl t in 0I |£#f>J£ JxfcfiL in M tti^#^£&$P 5 
l^iO^-^mid^^^^tl. *fcin 01 t^ft!lW?ftafP*SXORliiaS5 2"?^ 

^(Dtti^in ll0 ein (1 ,«f-^^»^5 3lC«t9 7 f -^mid ODI JC^Sn6 0 
OV^% -nbai^mid ()n0 tmid 001 O^til^!iS?P^X0RtH]S§5 4r^bn, ^Z)XOR 
HlS5 4Ota*tn,id fl0I «rtt^L-C B id 80 ««|+4. o£ 9 , ^*»aS5*»343.tt 
A^in^2o©t7Vpy^^ilt, :^2o^o^|;oK, * 

^J££fl343„ 343 2 , 343, £rfflV>-C, X — *mid 01 , mid^, mid (!:1 Id^&i-So 

«t£*Lfcr-*mid m) , aid,,. mid 02 , md n n. M 7 \zt* Lfc*^-* k„ K J: 5 

^t(7-l)~<7-4)WiSSL* £ ^T*>tLS» 

d W0R®n5 2izXV#fctomafa1fikbtl* *©aJ*mid I0 .enucl ini tt#*?l5 



mil 



«*«5 3lcJ:0^-^o U t 01 «^ix5. ov^% ^-*out„*out 0l <D#ft!lW 
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izmfe-tZo mm\z. mid,,, mid 12 , mid 13 mo^-cl, ^^^2^(D^ivme 

gg&fHS5 1, 5 3 t 2^<Dffl&ft&mfaiBl&5 2, 5 4 £ «fc 0 # 5 ID 1 0 Id^ L 
fc© t ^^COitM© 345,, 345 3 (d<t "9 x~ ^out,, out,, 

out, l:ia?&$;h,5o 

r^b^ir^^^^n/c4 0^)7 :f — *oui,„ out,, out,, out., (i, B^MMS (- 
dCO^U, ~ WlgSll^W-i^'Cte, #«^&gR343 0 ~343 :i , 345 0 ~345 3 T' 

wn-tcrt«ii-cA*f-*i s 2'3«)9 f -^i:»9J$n-c2o©t^» 
nmt&ift (mi o-pijsi, 53) id j; n*>. ^(otub. ^n<b 

3E*fef|5343 11 ~34 3 3f 345 0 ~345 ; , ^OA^f-^ i"5 r. i: a*T?£ So ^ 
5 1, 5 3 * 8 hS<DS-box t-r& t . #*fc7f2&&&l5343 0 ~343„ 
345„~345 ;l -^A^x-^mi 6 f y ##7&£!fcKI8:304 

JiiZEt^JtNTS&l Mfe#^^^341, »2«i##&?Ba5&*FB344 M^3t 
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7f^S3 : IiJSik,«:^o-C^iSl3KBa»twJ:»?*^n ^f-^i^lLt 

^ry/s 6 : i & 1 /ctt-r >^ y * ^ hi-*„ 
w& t mm^m^ y y c s 3 ~ s 7 .9 jgi% 

[211 1 <» 3<z>*&a«DmjBI4E5O^»^M»§P304 Id «fc 5*0,3 
J&U -?:K)*fl!S#JiKS:l21 1 2{C^i-o 

3 2 : f-^R'i ^mt'^ hf On^#]LTf-^in 0 , in,,-, in.., 
(tf'J;lt£m=8. n=4-C*£>5) o 
^f-^S33 :7"'-^in n , in,. in.., * *MK7 K t LT n *<D 

% 1 (DS-box j&^b-t^-t'^^—^midw mid "" '"' mi( Wi> ^^^• fcti "^° 

^■^S34 r^-Jmid^-id.,..,, IC» L»l*k„*« o 
£r?TV\ -r — ^mid.o—mid,,,,.,) ££/&1~5o 

^^S3 5 ^Wmid.^nud,,,,, «»7K^HtnfO*2« 
S-box ti^hf— ^out 0 ~out n ., $:I%^-tii-fo 

^-^S3 6 tT-'-^outo-ouV, fcStLtf-^, 
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±HS.* J ry7S 3 4W«*Ji» ^(7-l)~(7-4)t^J;5^-C'b=fcV>L, Xfi^<8 
-0~(8-4)W^jfeSr^ofc^:(9) (Cj:5^^-e^«tV\ Hid. Ell IXte^zry 

=7 A <fc L -C C OSS 0^ Of- 9 * H 5 J. U T i V \ 

#»^&£&344 «t5i6 -CSftW LfcS#«lM&3EJftlflS344A£ 4 x4 <DftW? 
SUfe-W-Cfi. ^7T^^344A^ 8x8 *T?UT*^i-»^t-OV^IftlMJ-t-5. 
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ar> £ i |5^H7^ r*toJHf&38, (i=0, l.-.N-DKifcs^-C, S^D^f-? 

£|5305 -C^^iX-C^-^L.MC^Sna. r-^L," <b x-^ R, 11^^306 t? 
^-^ffitt^SS^Sfffen, L j4 |*— Rj, R m «-L/tf>J:5K2:&i*n5o »?&fr#*HJ3 

flb©^P^r-n, R N .^^^^307 T'&^U ot0f'Jx.(i#6 4t' 
y h<D?a ■yfT-'-f'Ls, R s LT128 ^hOr-^U 

tftftS322 ^-#^^nXV^5ii7 : -*-^?ektC e t6^:-«^fe#^^308 "C£&U t±J 
^§15309 t-h^^Xt ^Xtit&v'-? CZltiJj-tZo 

A^L, gi-r — ^^rlU 1 3 irfii^t-. ek, k (N -, )n , k tt .„„ k (N . l);!) k 10 , k n , k 12 , 

k (in . k 01 . k 02 . fkZffik**-™**^ 

#«MBBfltt«304 rort««r#»lwttWt5. Hi 4tt. #*a*Hft«304 

flKa«*&322 tC««£*VC^*«7*-*k |n . k„. k, 2 t 
#K#M*»BB««304 M«^-* 
k.„»c:J:2,*i«*#*«**» 341 < «*.»i»te«i*afD^J:97-*-^R,- = R,ek l 

in,, in, in, 80<D*-*in. -in, fi, 

**W#**S*»343. -343, I^T, ^-*n,id„, ~mid 07 Ktffcfl**!** 
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mid 0 „ mid M) md n7 ^^m^x^"^mmm wmtfimmfu) Lxmtc^s 

XYJ^tl^tl^^^M. (#Nl!l#J!frSfn) Lt8o©^©f-^mid iai mid,,, mid 
I2 , mid l7 ^rtB^-t-2) 0 8 0(Dr- *tt#8M&3E8lSG345 0l 345,, 345 2 , 

345 7 (^A^$^, -tir-^iXT*— ^out 0 , out,, out,, — , out 7 <t £ix£ 0 wft 
b 8 0W|±l^v ::- -^li^-^^346 •C'^^iXT-r-^Y,' t 35Kffl 3 

iS&fi2£&lFI5347 Id&^Tr-'-^Y,' <t gSx'-^k;, t co^^SiCt «5 -r — ^Y,£ 

JfelFBtt^^^-CfeSiiS^So IP*>» rank(P)=8"C : fo5o WTI^ ^ 1 ^JS^JT 
m^Lfctd^C, n d 3&s*^t^5J:5^8x8^f?iJPS:*«)S. ^^t'll 3c± 

paiitTSrT=8, 7 iwjfeWbu &mm^T<DT^=?v xj*&m'ff-rz>o 

Step i : ££M1itT (TKM^T^nfcSffif*) £l££i-&o 
Step 2:^5 i^S^T-lUUi £ # 3?'J-<^ F/WMC^fflltl., 
Step 3 : MSCti^h 8 {[KT^iJ^ h A'tf>ili&Pc£igiRi~5o ^<^<t#v rank(P c )# 
8 h , ^(DPJtmffi t L#V\, 

Step 3-1 : P.^att-Sn^^ATO £ 0 K LT#&5o 
"&S^2?IJ (a, b?U) ^OV^T 

n d0 = 2 + min#{(t ia , t ib ) | t ia © l ib * 0, 0 ^i<8] 

(a, b) 

•ffig^3?IJ (a,b, C^'J) (dOl^T 

n dl =3+ m in #{(t ia , t ib , t ic ) | t ia © t ib © t ic ^ 0, 0 gi<8} 
(a,b, c) 

n d2 = 3 + min # {(t ta , t lb , t ic ) | (0,0,0), (1.1.1) *l* < . 0 ^ i <8 j 

(a.b,c) 
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• ftf© 4 ?ij (a, b, c, d?ij) ICO^X 

• , t t V 0O - 0l)(O - o ' l,O) - (O, '' oo,(, ' O0O) 0^i<8) 

n d3 _4+ mln ff ^ X 'a , " b, ic ' ,d '' (0.1. 1.1), (1.0.1,l).(l.l.0,l). (1.1.1.0) ' 
(a, b, c,d) 

n d4 = 4+ m in #{(t ia , t ib , t ics t id )|(0.o.o.O).(U.o.o).(o.i.i.i).(i.o.i.i) ^rl^< ,0^i<8} 

(a, b. c,d) 

n d5 =4+ m in #{(t ia , t ib , t ic ,t id )|(0.o.o I o).(..o...o),(0.i...i).(i,i.o.i) 3rl& < ,0^i<8} 

(a. b. c,d) 

n d6 =4+ min #{(t ia , t ib , t ic ,t id )|(0.o.o.o),(..o.o..).(0,i.u),(i.u,o) < ,0=§i<8} 

(a. b. c.d) 

n d7 =4 + m in #{(t iai t ibJ t ic ,t id )|(0.o.o.O).(o.u.O).(..o.i..uu.o..)^l^< ,0^i<8} 

(a, b, C, d) 

n d8 =4+ min #{(t ia , t ib , t ic ,t id )|(o.o,o.0),(o,i,o.i).(..o.i,.).(..u.0) Srl^ < ,0^i<8) 

(a, b.c, d) 

n d9 =4+ min #{(t ia ,t ib ,t jc ,t id )|(0.o.o,0).(0.o, 1 ,i),(U.o.i),(U,i,o)^l^< ,0^i<8} 



(a, b, c,d) 



• n d =min{n di |0^i^9} 
ltL®ft\^^^ *.n d0 -n i9 ^l^ff^^343 (Dactive s-box COfllgC 

mmmi*M.) tfikfrbtit-tz. %2#mz&WkMM5 tf/J^<ow 

m^2m) Ws-box^activelC^^ , Z(Dk tractive s-box £>-^f+^<oj^ 
_h (£iZ2) \Lt£Z><Dfr*^X^Z> 0 m7L\£. mi^^»^343T'2o<7?acti 

(Dt 

[Az\] = [t jn Az a ©t ih AzJ (0^i<8) (ID 

[Az' i ] = [(t i „©t ih )A 2 J (0^i<8) 02) 
tttZ. fifot, -^tj-g-^active s-box 13 n d0 X'^-7LhMZ.t\^. 
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±f£O10080 flKOtT^JPl-oV^ -?;cr)fg/&£$:&5 0 ±3&8S&tf)K:fl&fi)t&& 
6 iHi^XOK^^^ 5 £ Lt. (8X7)"^2 M fl^coft**:^^ 
S"C*)t). mft^fziifeX'hZo dl 5 AtC^-TJ: 9 «lfi2gS&gR344A 

CD f*l SFU^s 8 A^l 4 tti^j <T>i£y9 * Bl~B4T*tM flit tcPS^-f 5, # # .y * 
^©I^SlSfll^JiEl 1 5 Btl^tJ: 5K» 4<5OX0RlHlg|T-*«fife$ix-C*3l9, ^TO 
A^f^as 1 (Hl-foX0Rll]3S^iliii-5<^ , Li:^-2)o «|?KS^SB344A± 

i 6<iroxoRiEiBS-cfll^Six2>ri^/«c5. ^w<h£, (4x3x2x1)^2' 

vt^^^x £\,\ #3E^>J<y ^'^^li-ttb*sffA$tL-CV^5 4 7^ ffrbo 

Jiizfi^as^TyVa y XAlCct 10080 mofr&W ? % * Ell 5 <z>fflfi£4:ffi 

/cLoo N 1 6lE]£>S#iR3f (XOR) tHift?iJ I <t 45 \><Dith2> frX o fr&tS 

01111110 

0 110 111 
0 110 11 
10 110 1 
0 1110 0 
10 0 1 10 
110 0 11 
10 1110 0 1 

z<Dnn&&m LtMmWkmM^mmn&ttmm&mM. 345 t^mi 

6 »ti9t- £ 1 #8&7&£&SR343 Sr«J5)ti-5 8®roS-box 7><b 

087^ y©fe*4M«07'C Vl'ttU 4 ocD'£&*> * ^Bl~B4rj^51(Ctf 



P = 



(13) 
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P = 



(14) 



fg-T5 - <t#T*£5o Ell 6T'^$ft^^B^m^344AH, f^l:£i2t^ 
-^concatenation rules SrfflV^-Cj»^^*«^-T5 ^ t ^ ioT, 

o i i i i i o r 
0111110 

10 10 111 
110 10)1 

0 1110 0 1 
10 1 I 10 0 

1 10 0 110 
0 I I 1 0 0 1 1 

-(DZ.kfab. nWP^T^iPO^mWi^lt^^X^^^t^^^^c. acti 
ve s-box wft'JHS&SrW^Sfc, n,=5i <fil t ^angf §r 5 0 

«**»344Bli«^-^k ll0 . k m , k llfI -, k M7 fclM***ttwm**ro#«lW 
B&3Ifn»#fcXORlE]8&63 III 63„ 63 2 , 63 7 -em\m*v f -^mid I „, mid,,, mid,,, 

mid 10 =mid 0l ©mid„,©mid fl3 ©mid (M ©mid 0S ©mid n6 ©k il0 (15-1) 

m i d, , = m i d lin ©m i d 0 ,ffimi d 03 ©mi d a ,©mi d nB ©mi d„©k, , , (15-2) 

mi d 12 = m i d no ©m i d 0 ,©mi d n3 ©rai d M emi d 06 ©mi d D7 ©k , „ (15-3) 

inid, :1 =mid nn ©mid 01 ©mid n2 ffimid M ©mid 05 ©mid 07 ©k ii:i (15-4) 

mid,, = mi d„„®ini d 0l ©mi d^ffimi d 0 ,©mi d B 0k, „ ( 1 5-5) 

mid, 5 =mid 00 ©mid () ,ffimid 0 ,©mid o;i ©mid 0fi ffik i , s (15-6) 

mid, fi =mid n ,©mid oz ©mid ( „©raid 06 ffimid a7 ©k nB (15-7) 

mi d 17 = mi d no ©mi d„,©mi d 03 ©mi d 04 ©mi d n7 ©k i , 7 (15-8) 
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- coi&^Z. i t? , -r — ^mid,,,, raid,,, mid, 2 , mid l7 Sr^fifei" o„ fr*5» S'J^ 
k„ hiSo^-^ki.o, k M „ k ll2 , -, k, 17 -cfflF^$ix-CVN5„ mi 7K*5l^T, m 
i d 00 ~mi d 07 l3.ZM°tl%k S§60 o ~60 7 H $ 5o 

5fcg§60.„ 60 s , 60 fi , 60 7 ±03XORiHiK6i „ 6i s , 6i 6 , 61 7 "C'c ft-^iXmid,,., tu.id )inv rn 
id^mid,,,, nud 11H <bmid 02 , mid 07 i raid 0:i i: W#^te6*3SllSft»^^$^5c 

36Bg60„, 60, , 60,, 6O s ±<0XOR[h]*&61 ( „ 61„ 61 2 , 61 ;! l;^n^niid r , 0 1 XOR0SS 
61 B <£>fcfci2K mid ol i:X0RlH]S#61 7 WtH^, mid,,, t XOR0&61., ©ffl^K raid (a tX0RH]g&6 

5R8S60.,, 60 5 , 60 6 , 60 7 ±^0^62.,, 62 5 , 62 fi , 62 7 -£\ ^rtl^tUXORElS&ei, £ 61., 
(D&litfj. XORIU8S61 0 i:61 s ««-ttl^, XOR0B&61, t 61 6 ©#ltl^, XORE8&61, t 61 7 

5fiH60 0f 60„ 60 2 , 60 3 _broXORIs]B&62 0 , 62„ 62 2 , 62, T\ ^n^xXORtHg&Bl,, 
i:62 4 CO«-ai^, XOREHI5S61, *62 g (D&fttl . XOR0S&61, 1 62 fi (D&itiX. XORIUSS 
61 :i £62 7 co«-Hi^ft!i6*)8ftSfn»^^^iT'2>. 

Hi-* ^S£60 o ~60 7 ±OX0RliIB&63 0 ~63 7 X\ XOR0SS62,, ~62 7 (D^ihtttMy" 
— *k Iin ~k I17 irO^ftii^SlfD^^^nW^ ^f&60 0 -60 7 3i^-&n j PK 

m^mid l0 ~mid, 7 *sa^$HS„ >3 ffl^»mid 10 ~mid„ A^mid 01 , ~mid„ 7 j&» 
fbiSA^fc 6 o.hgir-*— 9 £0)SIKt&KJ!fcJS?Q3ia*fc£*V tigroid,, —mid 17 fiA^mi 
d 00 ~mid 07 Ti^ilA/ff 5 o t &r-9 t (DtimtotomftW* & iT-S. 

^-^mid 10> mid,,, mid, 2> -, mid 17 tt, 01 4^ilM»^lft 
&G345,,, 345,, 345 2 , 345 7 ld*JV^. ^-^out u , out,, out 2 , -. out, 

1&1&&&&tl'k.1&* ^-g-^346 K*SVvC. 8o©f-^out 0 , out,, out.,. ou 

tjiiiorof-^Y,* I^5ix5. x-^Yrii, ^7-'-^k i2 liJ;S^3 

^j»»aS*»343.~343 l , 345 0 -345 I ro*^-entt. «A«DESflffroS-box 
©i5/j:^-Cfc5, 0ij^fi-ROMIw«fc«9«fiS£$n, ^nWA^x-*£TK 
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£ £. % ^^&£&343 0 ~343 7 O^#Si^ • P^t5i> £2 

,w^^344 keii 7 \c^\.tcmm®:zm^tcm£, &&j&&&mo4 ±& 

3rHtifPgp ,nr t«^ > Mr=4 (S»12S) 

mid 10 = mid 01 ©mid n2 ©mid 0 ,©mid 05 ©mid 06 ©mid„ ; ©k ilo (16-1) 

mid M = mid 01 ©mid 02 ©mid o: ^mid 0 .,©mid 06 ©k fU (16-2) 

mid 12 = mid 00 ffimid 01 ©mid ra ©mid 0 ,©mid 05 ©mid 0f ,©k n2 (16-3) 

m i d 13 = m i d on @mi d 0 ,©m i d n4 ffim i d^ffim i d 07 ek, „ (16-4) 

m i d , , = m i d n „©m i d 02 ffim i d 0:1 ©mi d 05 ©mi d 0B ©m i d 07 ffik t , , (16-5) 

mid ls =mid 00 ©mid 01 ©mid M ffimid ns ffimid 06 ©k iIi (16-6) 

mid 18 =mid oo ©mid 0I ©mid o2 ©mid 03 ffiniid n . 1 ©mid o7 ©k jlti (16-7) 

mi d I7 = mi d 00 ©mi d 02 ©mi d 04 ©mi d 05 ©mi d n7 ffik, 17 (16-8) 

mi d 10 = mi d 00 ©mid ol ffimi d M ©rai d os ffimi d 06 ©k , 10 (17-1) 

mi d , , = mi d 0l ©mi d m ©mi d w ffirai d 03 ffimi d 07 ®k n , (17-2) 

mid 1!f =mid 00 ©mid 02 ©mid 0 . t ffiraid 06 ©mid 07 ©k jl2 (17-3) 

midn = m id 02 ffiinid oa ©mid 05 ffimid 06 ©mid 07 @k ill Cl7_4) 

raid 14 = mid oo ©mid ol @mid M ©mid 0S ©mid 06 ©mid O7 ©k iM (17-5) 

m i d is = mi d 0 ,©mi d 02 ©mi d ro ©mi d M ©mi d w ©mi d 07 ©k , l5 (17-6) 
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mid, R = mid no ©mid ol ©mid 02 ©mid 01 ©mid os ©mid n7 ©k il6 (17-7) 
mi d l7 = mi d nn ©m i d 02 ©mi d 03 ©mid 0 . 1 ffimi d 05 ©mi d 06 ffik , , 7 (1 7-8) 

^2M{£#3l7f^&SG344 itmi 7 — 1 9<DifcMfrbWbfate£?\Z^ 8oO 
A^r-*— ^mid f)(l , mid 0l , mid 02> mi d (17 <D ? h . Zft^tl 6 OWA^f- * frb 
±f&^tc 4 ^(DihJj?-*— ? t, Wm5oroA^f-^^^MLfc4o©ffi 
■ft*?— $ <D%%\ 8 oCOttl^-r'— ^mid 10 , mid,,, mid,.,, mid, 7 £r£fiic-t~-5 <fc 0 
Mi&fel&M^i&Xfr'O . 2> 3 0 8 OCD^-A^JT-'— ^mid no , mid 0 „ mid 02 , mid n7 

'>&< <t 1 4^u±<Di&<D^ifc<Dftt)^-f>iz.&^* J i-z-z> (mz-\$mi 7 (Dm 

X*fc>tl\3. Kf3"f— ^mid 00 H 6 l<D\£±l : f— ^mid„, mid, 2 , mid, 3 , mid,.,, mid 15 , 

m^—? {fk, k 00l k 0l , k 0i „ k I0 , k,„ k I2 , •• , k (K . l)n , k, N .„„ k (N _ 1)2 , ek} fi. £ 
£1*31 k e y ^Atim20 .0^-^41^321 I^A^H, ^Wgl^-^^ 
J&g[S321 laoT^^tl, ^1511^15322 (C#*K£ ft/cr 2 -^ "CfoS. 

«7*— *£fifc*B321 (Ct^^T"'— ^O^^^El 1 SBt-^-CD.fc:^^ 

344, 347tem^fcft-tz>mm&^&xfoztcisb. m^mmfete &nmmm£ 
u^<Dmmm^M^xh+^^±^^^^^—^^^ x '^^- 

SS341. 344, 347^ol^T, -t<^-Fftj&*£ll!ll&i"5, *fc»i«tliltfeflF L/«CV^|fe 

m 5 nmm 
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MID 0 .,= [mid 0 .„ 00—0 o) , mid w . mid 0 „ mid 0A , 00 - O,,,, 00- -0,.,,,. mid w ] (18-5) 
MIDos= [midos, mid*, 00-- 0 (2) , mid,,,, mid 05 , mid 05 , 00--0 (2) , 00--0 (2) ] (18-6) 
MID 06 = [mid 06 , mid 08> mid 0B , 00---0 (2)1 00— Ob,. mid n6 , mid os , 00--0 (2) ] (18-7) 
MID 07 = [00---0 (2) , mid 07 , mid 07 , mid 07> 00-0 (2) , 00— O^. mid o:> mid n7 ] (18-8) 
-ftb^^-^MID 0O ~MID„ 7 f3:, £*2llife0iJfc#^T^(8-l)M8-4HCo^Tt& 

7 [d^-t-^ff^^l5344A|Cl*5V^T, x — ^mid^ ^roiT07- *mid u ,~mid 07 £r 
Wn'00-0 l2 rrsStLf:i^t, &J&&&W344AO 8 ^«60„~60 T OttJ^lZ 
&tb*lZ>? i —fi<D*>yh-Clb2>o X-^MIDo.fi, x-^mido.^^W^iTWT-'-^in 
id 00 , mid O2 ~mid (17 $r^nW00-0 (2) "tl5^LfctJ^(C. &?&g&*FB344A<Z> 8 * 
^c60 o ~60 7 cbm^t-#^^-5x-^^-fe-y hT-fc-So WT, x-i?MID 02 ~MrD n7 l^O 
t^tPl|-C*fc5„ -fLib^ff^»343 fl ' ~34 3 7 * MM'M'-^ in 0 ~in 7 £ 
7Ku^i U 7 f -^MlD a( ,~MlD OT Sril:»BE^ffli-2Eife7 L -^fc 

tpmmmwu ka*$*i<"&. s&2«##«t^£&gP344 xi)?—** 
2o-ro^v^^#^til^I^fD^ t ?.xoR[H]sg4i,~4i, < t. ^n<b£>ttj^£ 20 

i 3X0R1e]?§4 3 t. ^(Dtht) km'f-fknk (OWmfttemft* £ 5X0R[£]SS 

MID l =MID ul ,©MID oi eMID 02 ©MID 03 ©MID 01 ©MID 05 ©MID n5 eMID 07 ©k il (19) 
riSfcH$n5. wrom^MID,l48fa<a^o y*K#SJ£n. 7*— *mid 10 . mid,,, m 
id 12 ,-,mid IT * U-CtB^^n^c |g2«0efc»^£&SHS344 laollf^ 

mid IO =mid 0 |©mid 02 ©mid 03 ffimid 01 ©mid 05 ©mid OB ©k„ u (20-1) 

mi d , , = m i d 00 ©m i d 02 ©m i d 03 ffimi d 05 ©mi d 06 ffim i d n7 ©k , , , (20-2) 

mid l2 =mid O0 ©mid 0 ,©mid (n ©mid t , 1 ©mid 0S ©niid 07 ©k i , 2 (20-3) 

mid l3 =mid o0 ©mid 0l ffimid ra ffimid 0 ,©mid n; ©mid n7 ffik i , 3 (20-4) 
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1211 3^7jk^tzm4mfamtmmx'hz>: sfts^*, zn&mtem 

^^Ly-c^2^^J^HS^W«^343 n ', 343,', 343,', 343 :! ' ^irlH^^ 

«^-^k i0i k„, k ii8 <t#^^P*m£fl304 ^©A*f-^i^5. ^-^R.fi, 
!Bl©te#^3E*W341 |C*3V^-C, il 4-C^Lfc©^il^f-^k i0 iW 

,*li$HPJ&B342 t^*3V^r 8o©r- ^ in,,, in,, in 2 , — , in T lC#5>J£ix5o 8o© 
T-'-^in,,, in,, in 2 ,-, in 7 fi. ^H^l^iWlg&Sl^S,/ , 343,', 343;,-, 
343/ iZ}3^X. ^-^MID on , MID 0 „ MID,,,, -, MID 07 ^N&?F^&£ 
^3&§r>343 0 ' f3\ mt> hcDx — ^in„ ^8Xmf-> h<DT'— ? 

MID„„= [00— 0 (2) , midoo, mid ao , mid,*,. mid 00 , mid 00 , 00— 0 (2) , mid n0 ] (18-1) 
Ul3g&-r5«fc5«fifc£n-CV^ 0 EP^>. »^«^343 0 'H, M*.ttW2 0 

mid ( ,„£ttl*lU TtfiCmfy H^00-0 ( »-«:tli*-f5S-box 343.** U 
V) T^midooSr 6 t "00-0 (2) "£ 2 9R«SH»«E UT 

^^^15343,' ,4Hl2 0B^i-«t9l-s -h&mt'^ h\Z.T-*mid 0i *lht) 
U Tffimlfy M:"00-0 I8 "SrtB*t5S-box *«tw«fc «3 ^-^mido.fc 

6 3Rtt^ttU-CW^i-*i:*^ mtf* ^WOO-O^ 2 ^ti^LTtB 
WT. *«l»**«8343 2 , -343 7 , 'biai«li«fit$^ B2 0Ci:*»»« 

NnD m =[mid o ,,00---O (2) . m id ol ,mid ol ,mid o ,,mid 0! ,mid ni ,00---0 w ] (18-2) 
MID ltt = [mid 02 , mid M . 00-0 O) . mid 02 , 00- -0 m . mid 02 , mid 02 . mid 02 ] (18-3) 
MID„ :1 = [mid 0:i . mid 0 . mid 0 „ 00-0 (2> , mid 03 . 00-0 (2) , mid n ,, midj (18-4) 



WO 99/38143 PCT/JP99/00337 

37 

mi d, , = mi d, OT ©mi d 01 ©mi d„©inid M ©iiii da,©k, ,., (20-5) 

inid ls = mid rei ©mid ni ©mid 02 ©mid 05 ©mid o6 ©k il5 (20-6) 

nud l( ., = mid ol ©mid 02 ©mid a . 1 ©mid 0fi ©mid O7 ©k ilfi (20-7) 

mid 17 = mid nfl ©mid 02 ©mid 0: ,©niid n ,ffimid O7 ©k il7 (20-8) 

magi 1 7 x*m.w^tcmm&zmtt(i5-u-tts-s) t^mtemmmx'tb 

Z>. ~tUc£*). m4m^Mt^)C s f— ^mid,,,, mid,,, mid, 2 , mid 17 ^^^-f 

3 0 t£is, ©ISIt*— *k„ li8o<Df- *k„„, k iM , k il2 . -. k„- frX U ^ 

•60 

#, v ^ ^_^ midio> midilt m id 121 -, mid 17 n, ^nmii4tro^« 

&gR34 5 0 , 3 45,, 345 2 , 345^*5 l^T, t 5 — *out„, out,, out,, out, i:^ 

M$£&£ft>1i.&* 3fg-&lF|S346 IC*3^X, 8o©r-^out s , out,, out 2 , out 7 

tCj»^»!tfe$n, 2M&J£F«£B304 a»fc<7>W;&^- 

1212 n^i-«t9tw. &2mfe&mmmm4 xn. m&m&mvnmm- 

SM^JfrPJ^**^ ^^»^343 u ' -343/ <t 345„~345 7 (i 8 0^0 

hn-r-<xmmn^mxh^o * <bi^ *»j»**«343.' -343/ v^mm • 

^y^^^^^IfeSfn^ioTt.tVV, O*0Bll 7 ©XOR63.-63,, C 
hH^tSHlB, 19, 2 ltt«#fr**L,-Ct>J:V\ 
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*£«S:Sr^fiSi-S«^JSr^i-o **J*»2£fi (CPU) no , U-K^'J-^ 

(ROM) 120, 7^^7^t^^'J (RAM) 130, I5lf^® (tfijx.fi* 
A -|ff^^HD) 140, 1/0^ ^^7^ — ^.150, RXfZ.tib&EL\'^8&fctZ> 

s<*i6Q te— teWfca^tfa. — *ioo &«j*l-cv»5o - K>3&p;r,w«k5? f --*&£ 
Sfe^aSrmiE-t-S^D^^^fi, ^jtfc£IEl&&#fc LT<7Vn— K-r-f 140 d 
t&*rt$nTv^„ ROM120 tcMi-i^H cos-box tf&k L-ct&*fl£*v'Ci^5 0 

T 2 '— *#1ft&fI&llf"H-&l8"K, RAM130 H-tC^n^^ASr^-K^^^i'l 
40 ^P>W^5i^, -r^^^^-^150 ^ LT¥iM^A^ i C P U110 

^150 $r^urai^^n^ 0 

so izfem\^tz.i><D&&m ur t «tu^ K^-r^no ^^Lx^tEtt 

^#180 T^fe^o K7*-f 140 !:-J3^fCfJfflt?)^^ RAMI 
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% \z ±m <D ttfo -r 5 w $R a* # * >o x u * e> Pp^ h # fe o ^ o 
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ti6G»A* (Y,., =Y J , vj., kLXmmZhZo ZZX\ Y. I«© 

-$-7Lbtitc^mK\zftL, WlMk; (i=0, 1, 2, N-1) * UT (D & ? \Z.l£?> 

(L„ (Y„ v 1 ))=G(Y 0 , v 0 ) (21) 
(Lj»ii (Y JM , v J ,,))=G(Y j> vj) 

(j = l, 2, M-1) (22) 
kj = H (i, L„ L 2 , L M ) 

( i =0, 1, 2, N-1) (23) 

IS 6 (OHfiSffi) 

i23 Atd0 4-C*U*:«ifefiJt^^^^— ^SP2 0 6 ^tfe0ij0>« 

*f«l«£ric*|5220 tt«e«E6<J^«i^-f (MIS:) OG«5:tU ^RflfcL, 
~L M r*vfe*rfl«l41B«3fl230 KHEtt^ftS. f5'tt.^230 fdf2lf,£n 

z. <o m x & . % \z. mm u tcu n e> ^ * a # £ ^ v A * ^ - * 7 ^ y a < t 

&5gfT'fe5o ^plbO*[lm^•C'^^nT^^6^^^^^-^ (S3) "CN 
0 TU-tn^OQj &#<D%~i f-y h@<£Hfi^e>I'J§tk 0 £«fifcU ^rix^ft^Qj 
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k,, =(Q,[i], Q,[i], -. Qjtil. Mil) (24) 
lSi, j^l6 K&Se 

y/ fiYj <75T{4 3 2 try r<z>fii£:Sb"ci^5o 

A"^(Yj. vpK*H-*GBa&<z>ai2>& 

<L JM . (Y,.,. v jlt ))=G(Y j . v,) (OSS j S7) (25) 

v i. _ v « (26) 
'j-i 'j 

Yj.," = Lj.. =f k (Y j \Y/ i ©v j ) (27) 

_ v ,. (28) 

Iijftk, [± i £L, — L H COm^t VXfr&X^ZtlZo 

k, , =H(i, L„ L 2 , L.) (29) 

PJglk, £ 

k, = (t«\ t/-», t 2 <», t,""'\ -. t.<'\ t.«"») 

( 1 =g i £16) (30) 

£*v. A$A**n. *jSBOGBBtt»22-j», Yj., fcv,., **A*Sn, Y,, * 

&awGB8tt»22-(j+l)-«t*&*n*. o*«9Y 0 -K. v. = 0 1 tt£ LfcfclCG 
BB*«22S:8EWaii-o G B8*tt*>*j**BI 2 5 1^1", - ©*J*K» U * 
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j = 0*»<b i = 7 tLX-rnVfe-t* 
*=rV7\ :\' } tv, fcGia&*B22-<j+l)U:A^i-5i:, H 2 5 * Or- * 
^B221 &/B^TYj ^20©^n 3/* (Yj\ Y/) IC^H"^ 

**ryZf2. :Y;- Srv JM tLTIti^tS. Y/" &^-*MteB(f k )222 |:A 

7fy :/3 : Yj" ^T ? -^Amts224 IdA^Oo Y/ t Vj ^^f&WSftS 

fpE^223 ^A^U-CY/© Vj £ft*U *eO&*&^-*&»£B(f k )222 KA^-f 

■So 

tf#*£*£L Jt| t L-Cttl*-t-5i:l53B#l-, ^-*AfcSI224 !'A^1"3 C 

^^3/ 7* 5 : T"'-^Am§5224 [3, Y/ £ -r- * (f k ) 222 OttH^Lj., 

%A^iUT§(t^t> Y/ SrY^. Lj„ *Y J4| « tU Yj.j =(Y J „ L , Y^tiSgi 

Gg8«C«S22-l~22-8^tti^Ufc8ffigwLj Sr. fSt*£[5230 (I2 3A) [Z. 

1 f3/ 

(t/". t», t/^^L, (j=l. 2, 8) (31) 

k, = (t, (i \ t,»-'». t,"\ t 2 »*'\ -. t B "\ t ll ""' , > 

(i = l. 2, 16) (32) 

% 7 <P jllfefflj 
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±Mme>Mmntm\^wm^\hti'tz>%m^m^M2 3 b, 1124, 125, 
m 2 7 &mm\~xt&wi-z>c 

[HJ»£ric«B220 li[H2 3 ACD-^rit^-C-fc^^ o£ "9 El 2 4 5 K1£ 

tcOG«r»22i:^^ 0 c©G it^X'tFsliLj ^M^H^ril:, 
^WIOLj »i, B'ltt5i^SH5250 X. g'lfik, tf> i .irk, Ct? hffiiq £: K «fc t> ife* S 

OS 9 *ra©£j#*IS220 t !"J«dfeJS«250 tlCi 9KWf y^l 
s/:/7£-C&, j=0A»bj=7*t?tR«3jgi-wi:lc:/i5o 

:Yj £ Vj &GH»*IS22-<j+l)KA:fi-fSi, x-t5'^*'J^«221 £ 

^y^2 : y; Srv Jtl tLT^tS. Y> * (f k) 222 

^X->^3 : Y/ £r : -^A&iS224 KA^-TS. Y/ i: Vj Sr^toWSftS 

fp[Hl^223 (CA^LXY/ev, ^A^m{Cr-'-^fe^l5(f k )222 HA^t5. 

*=ry-?A iY;- iY/evj £ A*> t Lt g ft. t * t ^~ * <f„) 222 tt, * 

(Di+^^^L jM k^xmm£.&m5o (E2 3B) K^t>i~ z> t mm^ . <?- 

*A*kts224 ClA^So 

X^yfS :^-*A&2§224 Y/ £ =f~ 9 (f „) 222 ©111^^,, 

SrA^LTS^*^ Y/ *Y jM \ Lj.i frY,.,' <^ LY,., = (Y,./, Y^fcilttL 

2l LTTta^ J; I- 1 tr y V^t I- 

/ t en t «) ... t. <32) )=L i (j=l. 2, -. 8) (33) 

^fULT. W$R»iESi252 ULArt-fS. 
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<D f y h jig q Wffl *B £ £ 

kj =( ti <», tl <«M>, t,"\ u""", -, C>, i^) (34) 

£ &5 «fc 5 BJ&k, ri:Cl 6 m^t^ titzU-WM260 ICLj r* £ !cf£tt1-£ 0 

15 8 gd&ffl 

(Lj- 1 . (Yj... v jM ))=G(Y J , Vj ) (OS j S7) 
((Y/'\ Y/", Yj' 10 , Y/"). -vj)- 

r / T (D T (2) T (3) iWwfyR Y^,Y^,Y^),v i+ ,]) (35) 



t-rz> 0 

Y<;1 =f(Yj (i> ) (i = l. 2. 3. 4) 



(36) 



t(°) -v < 37) 



L'-i^fCL';;,")©^;! U=i, 2, 3, 4) 



(38) 



k s =H(i, L„ L,, -, L 8 ) (40) 

qi + 4j-L<;;;> a=o- i. 2. 3) m 



(t[ 0) ,t| , > f ...,tS 7 >) = q i (i=0. 1. 31) 



(42) 
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i (.((''2]) .([i/2]) .([i/2]) ) (i=0 1 •• 15) (43) 

-mm 

: i <Dt*y htlfcrt. 0123456789abcdef 101 1 12 (hex) <n ±.\if.fr 

UiT«#0*j=O. l. 2, -, 7lco^-t,^>9iSi-c 
*^5^1 ^^fcAO^MHY;", Y". Y», Y/^^-TSo 

: l~614^ffi^i = l, 2, 3, 4 tJtLt, Y j ,/ i> = f(Y 

^^■y^3 :Vj tL it r 4rl?l-tai-Sc 

: *f— *fetfcS5621~624£ffll^i=l, 2. 3, 4, l:^tt« f^i"" 1 ) 

7.7- : v jM =L jM ( " t*$<o 
mm±J&: !6»Ji»LT, *(43)**9iU k„ k„ k x (NS16) 

(1) Y 0 <r>*4X1>K Ki^l^i^ Y 0 ©-^KirU «9*6tt^ 

(2) v (1 fcLT, ffi&<73?t$c2:1~3 = 

(4) f ^(3t^{b^ffl^^^^ffl , -^^^ <7?,b£7) ^^ 0 



WO 99/38143 



46 



PCT/JP99/00337 



(6) Hznmr&m^. mQmmtmm<D^<D*\$io , 

+ |Bifi|^fiJ£«P220 , giJ«t^fiKSU240 . 250 (±H 2 2 L 7t = ^ t" a - * Id <t 

■c«*. k.. k 7 , k B . k 91 k, (1) K^m^m^-i^ ^m^^ci 

h# <*J*.tf* *6, 7, 8, 9. 10, 11. 22, 23, 24, 25, 26, 

tt{aicond} : ^cond^?iSifci-#^ a roflB^o 

Ax, rx:x©^l, xtf^*^. 

a.b : aibO^ hS©"«:Mt5»'!)^l. 

P-Ct,,]. tu^iO. 1). 0<i.j<n-l 
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m%m&U(DA*) : /. = , Cz u .-,z 1 ^,]. z,eGF(2'). 0<i<n-l 



[J&»1] Ax, Ay, Fx. Ty tfi**. htltz t # , s-box <DWM% *PDP"< Ax-* 
Ay) t^ff^^LP , (ry->rx)^J^Tc75j: pt-^feS : 

DP 5 ( A x-> A y ) = U { x e GF (2°) I s (x) +s (x+ A x) = A y } /2" 
LP s (Ty-)- rx) = (2xi*{xeCF(2 D ) ix.rx = s(x)-ry}/2 8 -l) 2 

[zes§2] s-box (Dm*g:ttfemp s tm*mmmq x zuT<n±?izmibz>. 

Ps = max DP 5 (Ax Ay) 

Ax#O.Ay 

q s = max LP s (ry -» Tx) 
rx.ry*o 

fitftf^^ffiry tfS##-C*>5s-box ^^<t tractive s-box i ^ 0 

[aeH4] 2-round SPN«it■C«fi£*i^S9^>KB8IB[^w*3V^-C, Ax, Ay, T 
x, Ty KH-TLbtttZ. ^**p(Ax^Ay)i»^q(ry-*rx)SraT© 
J: 5 id^^^c 

p(Ax -> Av) = max II DP s (Ax ; -* A Zj )p(Az -> Az 1 , )DP s (Az' j Ay,) 



n-1 

: n 

Az i = 0 
n-t 

c n 

rv i=o 



q(r y -> rx) = max n LP s (r yi -* rz' 8 ) P (rz--> rz^LP^rz, -* rx,) 

MV ^ rz' i=o 

— T% Ax=(Ax„,-, AxJ-Cfc^ Ay, Tx, Ty fcR*-C*>3. p(A 

z->Az',)ii. ^iScMLr, Az wmti^AzM:^^^^ 
^Ltv^^wi:t6 0 BP*,. itroii:*tU, 3Az' s s. t. p( Az-* Az' f ) = 

ltfe^ pcrz'-^ rz;) t>is]#-c*>s. 
BJtmmq &ut<o£ 9tw^«>5o 

p= max p(Ax-^Ay) 

Ax*O.Ay 
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q = max q(ry-»Tx) 
[£$g6] 2-round SPNffitlI*f LX , ±X<Ds-box Xtb 6 B*. Wdffc 

n d =min[H w (Az) + H w (Az')] 

Az*0 

n.^mintH^rzHH^rz')] 
rzvo 

H w (z) =3{0:£i<n ! z,^0} 

[3« 1 ] 2-round SPNtHitO y V ^ KB3&(-*Stt Z>McXWM% m p ti» 

p^Ps"" &t>* q^q"' 
[Proof sketch] 

^^^?I^fecD^-^{CoV^X#X.6o. J£&2 <b£&3 «t K> , active s-box (C&tf 
5i^^[±p.,yTt'fc5, jlot, &5Ax, Ay KiS ft 5 active s-box rofB& 

&2>o — *\ reactive s-box <0*'JHE&£ 1 _ 5 £ , itOAx, Ay IC^LTn, 
[^12] Concatenation Rules 

XH (Y. Z)&» T-'— ^Xt^t"— ?Yif- * Z©2oOf- *{d|p]U.< $S3fi!£;h, 

5 r. i ^ttitSc Bptb* x=y=z jasfigi-rs. j^r^^^iz 



t - * - 
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i"S : 

X = Y©Z AX=AY©AZ, TX= TY= TZ (XOR operation) 

X_| (y, z) =* AX=AY=AZ, rX=TY©rZ (Branch operation) 

Wftli, active s-box 0*'JMH#n - , n,a»fefc«>* 0J;U£, *T 

^iP^m-t'mmmn^'^X'h z> <dx% h. ( a z) 2? 2ft h m. < a z ' ) ^ 1 -e& 9 , 

SfcH.(Az)=l^f 3 fi*H.(Az')^3X-^2)^<!:^ i, b. active s-box OfH^ 2 {Cft 
3 ~ kl*foK>m^^X\ n^tftS. ir^»T\ 0(1 AZtrAz^O, Az,= 

Az s =0©B#, Az>Az,*0, Az'rAz'fAz'rO (H.< Az' ) = 1) t ft 9 . active s- 
box <Z5fi«C»i. H,(Az) + H.(Az , )=3-Cfc6 c flfeoT, n,=3 fc ft 5 OT?, tlU9 
C^C^KriMtttlipiPs^fcS. ^fcn,l^>tt^i©if^t-#, n,= 

3, q^q, s "Cfc J 5 - tti^-te^o 



i 
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n fa ^ if ^ - 9 (D^M'ti^ &wmw&* \ ^mmfe^gz t , 

2. ff*JIll^«i^cD7 :^ -^^^M^*3v^T, 

3. m^m2^tm<n7--?m®:'mm^^x. 
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4. instil 2 ;sm 3 izsmnT-fm&mmz^^x. _kSE*m££-^ia:ro 
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i i. 7bm i oo^-r^i otcetto^-^ae&isaiwis^-c, ± 

EnXn *r ?IJH 4X4 ?T?'J"Cfc 5o 

±tzm2mmmm&fc. ±remi#&^£&#s«fc9^4o(7>w*>Ai, A2, a 

3, A4^A^JL-C, 

B1=A1©A3©A4 
B2 = A2©A3ffiA4 
B3 = A1©A2©A3 
B4 = A1©A2@A4 

^r^n^tLiKStL-C, ^-?B1. B2, B3, B4«rtt5^i"S¥S-Cfo5 - t Sr^DS t 

®^-*k2=[k21. k22, k23, k24] hAtl^tl. _k|EBl, B2, B3, B4&*#5*# 
ic, *r*VEr**Lk21 t k22, k23, k24t^6*J!iiiSft»Sn5 ^. <t t "fS^- 

i 4. is^jsi i ^te«OT--^^m^®i-*5^x, 

nl, in2, in3, in4cDinl £4mf y Y OMI1 = [Al, 00-0 (J) , Al, Al ] I^M?) ¥- 
St. in2£4mt*;y h 05MI2= [00-0 a) . A2, A2. A2] Kgfc-fSSMSi * • in3£4m 
fjx h<DMI3=[A3. A3, A3, 00-0 ( „] ^^^5^^ . in4£4mfc" * h CDMI4 = [A 
4, A4, 00-0 U) . A4]tC^i-S¥S^«tO^«9. 

±E*2*?l5«»#^±^E»l***^*^ a ' ,:909f ""^ M11, MI2, MI3 ' 
MHSrA^LT, B = MI1©MT2©MI3©MI4*«»L, B=[B1. B2, B3, B4]*m^-f 

4 m t> h©|f'-n2UM^, ±|EBW*»tlCk2t*ft!L«}!ftafd»SnS 
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IS n x n nmt 8X8 'rr&iX-&>Z> u 

i7. e^umo^f-^^'^Wi^^^x. 

'^Ife^SroSoOtti^lJ-^-^Al. A2, A8W5*>, 6 OCOify^'- ^ <D 

^Ntilfi^Jl^^ct «J 4oOa^t^f-?Bl 1 B2, B3, B4=H#, ±IE8o©ttl 

*B5. B6, B7, B8«r#5#S:-CfeSwiS:^»ti-5^-^^g«. 

22, k23. k24, K25, k26, k27, k28]t>ArtS*U ±tRMW? 1 ?-* [Bl. B2, B 
3, B4. B5, B6, B7, B8] **#5#ft!ittSft3?n*K ^MW. «7 f -^k21. k22, k 

23. k24, k25, k26, k27, k28*S^fm«38»SfP $ ftS r <t £ 1-5^- 



1 9. fiWIl 6ilIE«fe^^-^^^« t;i * 3, ' > " C > 

^inl-inS^^'t^mt'-;/ h^x'-* 

MIl = [00-0 (2) . Al. Al, Al. Al, Al, 00-0 (l) , Al], 
MI2=[A2. 00-0 o) . A2, A2, A2, A2, A2. 00-0,,,], 
MI3=[A3, A3, 00--0,,,, A3, 00---0 (2) , A3, A3, A3], 
M14 = [A4, A4, A4, 00-0,,,, A4. 00-0 (B , A4. A4h 
MI5 = [A5, 00-0 ( ,„ A5, A5, A5. 00-0 ( ,„ 00-0 (2! , A5], 
M16=[A6, A6, 00-0 (2) , A6. A6, A6, 00-0 tt) , 00-0 u) ], 
MI7=[A7, A7, A7, 00-0 a) . 00-0 m . A7, A7. 00-0,,]. &tf 
MlR=[00-0 (2) , A8, A8, A8, 00-0«„ 00-0 (J) , A8, A8] 
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tiLX. B=MIl©MI2©MI3©MI4©MI5©MI6©MI7©MI8£rifc#U B=[B1, B2, B3, B 
4, B5, B6, B7, B8] ^ttitft Z^L&Xh 5 ^ t ZftWlk i~Z> 7—9 3£&I£fi-_ 

2 o . w*3s i 9 ^tm<D7-'-?^&mw\zte\,^x, 

2<D}mm^&%ft? J %2#^&&*^ y7k. RV 
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2 3. fft**l2 2tCfS®Ofe^^^^^T. ±ie7-'-^^^^o^"7 Att, 

_hta Xti 7 s — 5 ft o t _hfE#)g] #f 'I ^y- y -f^W&lr ZWMW&^t- v 

2 4. f»*J5 2 2X»i2.3lwffi«©fS»«E<*»-*3^T. ±f£ir o 
2 7. H-5^112 1 7!;3g 2 8 cov^Tia^^ 1 o(cIE|S(;<75|E^^{${-*= < ' N T, 
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2 9. »*JS2 1^1E2 8W^^•fn75»lo^BE«lOl^fik^0£^$^w*5V^T, ±IEn 

3 0 . 2 9 ^iBttOtS^^I-iSVNT:. JitEn^Jfi, Jbie^ 5 ^s*- 
-^;L5 tj(7)<ir LTal^^Hfc hCDX'h K) , Jbten d {±active s-box<Z)ft4><H!BrCfc 
3 1 . HI#J3S2 1 A»b 3 0»v>i*iX7&McE«lOffi^i*{w*5V>-C, ±f£n x n 

3 2 . fn#g(3 i \znm<D&&mmz&^x . 

1, A2, A3, A4^A^Jb-C, 
B1=A1©A3©A4 
B2 = A2©A3ffiA4 
B3 = Al©A2ffiA3 
B4 = AlffiA2ffiA4 

^^M'^Un^X, T-'-^Bl, B2, B3, B4^ttS^i-^>^^^7 : T'fe5 0 
3 3. W*gJ3 2 ^fE^IS^^^T. 

(Dm?- ^k2=[k21, k22, k23, k24] <bA^£^U ±«EB1. B2, B3, B4£ 
^2>fS5riC, Ztl^tlMU k22, k23, k24t«lfti&Mll £H5 0 
3 4. f<t*Ig3 2Xtt3 3l-IS«ECOfE»^t-*3V>-C, 

-^_^ inl) in2 , in3. in4(Dinl^4mt-5/ hCOMll = [Al. 00-0„„ Al. A1]K& 
^ti^fy^, in25r4mt'-y hfc>MI2= [00-0 o „ A2. A2, A2] 5 ^ 

in3^4n,t'^ hCOMI3=[A3, A3, A3, 00-0 ( «] JC^ifti" 3 ^ V ? t , in 
4*4mtf* h«OMI4=[A4, A4, 00-0 (2) , A4]H«»-*-6 ? ft * V * 9, 



i 
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MI2, MI3, MI4^7x^)L-C, B = Mll©MI2©MI3eMI4&8S» U B=[B1, B2, B3, B4] 
3 5. i»*3S3 ^EttrofB&fltttlwJo^-C, 

36. W#35 2 1 M3 0©^W>1 o^IE*£WI5&^*^S3V^T, _bf£n 
x n 148X8 tr^'J "Cfc 2> » 

37. it&m3 6\ztm<Dszmmmz^^x, 

^^«^X^^c7)8oc0tU^-9-^-^Al, A2, -, A8tf>?*>, 6^ 
^-^^W^afP^^^^O^ffl^l^^-^Bl, B2, B3, B4*», -hIE 

^-y^—^QS, B6, B7, B8&#*> ^7" 5/ ^"Cfe 5o 

3 8. t*#*3 7JCffi*Ol5fftJKff^*5V>-C, JilE»2«l»«»^yy^tt« 
*#*^£**^:^fco-C, ±1E«E*^«^»tt*nfc«lf f -*k2=[k21. 

k22, k23, k24, K25, k26, k27, k28]*>A7j£n, Jbffitb^i^^- * [Bl. B2. 
B3. B4, B5, B6, B7. B8]*»6#te«Jlfcaft*^*il*n. *^-*k2l, k22. 
k23. k24, k25, k26, k27, k28a^fGltt8ft3*o£ftS. 
3 9 . 3»#Jg 3 7 Xtt 3 8 li?S«iK>fS»^»-*3V^, 

MIl = [00-O tt) . Al, Al, Al. Al, Al. 00 - 0,,,, Al], 
MT2=[A2, 00-0 (J) , A2, A2, A2, A2. A2, 00-0 (2( ], 
MI3=[A3, A3, OO-Oo,. A3, 00-0„. A3, A3, A3], 
MI4=[A4. A4, A4, 00-0 (2) , A4. 00-0,„. A4. A4] . 
MI5=[A5, 00-0«. A5. A5. A5. 00-0*. 00-0„. A5], 
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MI6=[A6, A6, 00—0 tt) , A6, A6, A6, 00-0 (2) , 00—0 (z) ], 
MI7=[A7, A7, A7, 00-- ; 0 (2 „ 00-0 (B , A7, A7, 00-0 {21 h &T>* 
MI8=[00-0 H) , A8, A8, A8, 00-0 tt) , 00-0 OJ) A8, A8] 

-hlE^2^«^7 i ->'^ D {i. -LIES 1 &mte&&x : ry7± '0 O^'-^MIl- 
MI8£A^ IT, 

B = MIlffiMI2©MI3©MI4©MI5©MI6©MI7©MI8 
3:iSI#U B=[B1, B2, B3, B4, B5, B6, B7, B8] ^tU^rTS s/^-efcS. 

40. 1**353 9iztm^mmm'^^x. 

4 1. f*j£335l 75ig2 OO^W»1 ocox— *3EiM£1Bl-*3»' N 'C, 
0, 1, M-l) ^^MtSGnt^h 

JilEGM»#Sf4x ±fE£*tK£ % Y 0 i t-tti: LT3jl0&3K j+1 

(j = 0 , 1, •-, M-l) }StB<omtl (Lj , Yj , vj) ^CDYj £ v,. &A2>U 

_t8EHM^©«, i o=i. 2. n) t±M^mm.m^^L„ L v 

4 2. 8*3fc*g 1 TiS 2 Oflnvfft** 1 o^|E*feW7=- ^ H 
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i«K*iAA$n, mmft^mt-tzM&frbte*). &&£<9*mmi j (j=o, 

l. -, M-l) jsfc#&£f£i-SGK&^&i:, 

±IBHHtt*«tt. i. (l^iSN, iSiSM, l£q£k, ©tfy 

A^$nfcY j ?:2o^p^(Y j L , Y/) i^i'J U Y^v,^ LTffl*t5f-^ 
±ieY j "*Y J ./-*U -tKL Jtl *Y Jtl '*U ^^^Y.^BMr^LTY,, 
(t^. t/ 2) , t j CE0 )= L, <j=1.2. --.M) 
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(i = l,2,-,N) 

45. iSf*jg4 2{wiE«fe<^7 ? -^^ift^fi»c*5f -c. ±kh passim, 

(tj' 0 , t™, -. 1/*°) = Lj (j=1.2,-.M) 
JilEfy Kt/ 0 , tj <2> , tj <2S> )*»b i t^b-Ck^K'ty htteql-«t 

(1 = 1,2, -,N) 

(L >If (Y JM , v jM ))=G(Y J . vp (0<j£M-l) ICjo^T, 
( (Yj (l) , Yj <2) , Yj (,1) , vp-» 

lit', Y{;i =f(Y j (i ') (i = l- 2, 3, 4) 

L (0) =v- 

L^-fa^evj:! 0 = 1, 2, 3, 4) 
v - L (4) 

kj =H(i, L„ Lj. -, U) 
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q.-i = L';;," 0-0. 1. 2, 3) 

(tS 0) ,t^,... J tr ) ) = qi (i-o. i. -. 3D 

l. f,([i/2]) t ((i/2]) t (li/2]) ) (i=0 1 .. N-i) 

4 7. ^e^bl'iai*^^^*— ^t58ttfcot, 

3E©K#A:&£*K Wt^tSM^f,/^, ^.t^fPflffiLj (j = 0. 
1, -., M-l) 3 G&a»#«^ 

BtBlfi (j = 0. I. M-l) jJ£§*>it^ (Lj » Y,. v s ) qxDY, fcv, *A*U 

4 8. ^f^fel"!^*^*-^*^*^** 0 "^ 
1 M-l) j*#&£/S-r*GM»3M&*. 
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®@*Sj®@©ta^ (Lj. Y J' V P ^^ y j> Vj&A#U ^WA^&ttftfcLTLj.,, 

4 9. Ift*33l4 7X13.4 8^SE«tOS*»-i3V N *C. -LIEG MSfc^Sti:. 
A^^f:Y i ?r2o©yD^(Y j L , Y/m^SUU Y/-£v jt] £ UTttl^t5f-^ 

JiiaYj^Yj.,^ L> -hlSL^Y^ U <b Y jH L * Y^SV^Mi LTY,.^ 

5 0. W*^4 7^IE«»3gftt^*3^-C. _bIBHB8&3MS:te* 

(t/", t/*, t/ 2N) )= Lj (j=1.2.-,M) 

(i = l,2, -,N) 

k*l£tSo 

5 1. If*il4 8 l£lStt<0£fit::*5^-T\ ±ffiHS!B[#S:»i, 
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(t/", tj 1 " -, t/ 20 ) = Lj (j=1.2,-,M) 

ic^f 'J-t- 5 tr h ^-fJ^IS: £ , 

k) = ( t /'», t"*". t 2 (0 . t^», •-, t H (i) , t,^ 0 ) 

(i = l,2, -,N) 

£ its * i" 6 f * h fe&ztfk . 

5 2. ft*rS4 8 |wlE«c«53S«U:i3V^, 

(Lj M , (Y j4 „ v j . 1 ))=G(Y J , Vj ) (O^j^M-1) H*3V^ 
((¥/'>, Yj (2) , Y/"). Vj }- 

(/t(0 t( 2 ) T< 3 > T< 4 h IYY (,) Y (2) yR Y^h v-.,l) 

::t. y{;» =f(Y j {i) ) (i=i, 2, 3, 4) 

L ,0) ,=v i 

I^ 1 = f(^ , )©Yl:! = 2, 3. 4) 
v - L <4) 

kj =H(i, L„ L.,, -, U) 

q4i + j=L ( ;; i ,) (i = 0. 1, 2, 3) 
(t5°>,t} 1 >,....t{ 7 >)«q i (i-0. 1. 31) 

, [ t ([i/2]) t ([i/2]) t (ti/2]) ) (i=0 j .. N-1) 

= I t 0+(imod2)' t 2+(imod2)'-' l 30 + (.mod2); 
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53. 3=mK*AtiLx&$k<Dmmk i (i = i, n) ^^-t-^Ht^^ 

^•^a— vu3£tt&=a ^t*^ — 0 lift S-tirSfcfccD^n ^7 i*£f£§l LfcfE 

i-S^t^fifigtWld^lHllftSL, ^^S^'^tc + F^L. (j = i, 2, M) 

54. ^SIK^A^LTflHSrofflttk, (i = l, 2, N) *^fiSc-rSPf^-»^ 
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